Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software The Internet Unix

Ongoing Linux/Solaris Compromise Epidemic 366

Posted by timothy from the active-malice dept.
An anonymous reader writes to point out that Stanford's Information Technology Systems and Services "has written a summary of a series of compromises that have been happening at universities, research institutions, and high performance computing centers, for the last month or more. The attackers are using known vulnerabilities in Linux and Solaris, along with compromised user accounts, to gain access and control of systems, from standalone servers to HPC clusters ... (the attacks are still ongoing)."
This discussion has been archived. No new comments can be posted.

Ongoing Linux/Solaris Compromise Epidemic More

Ongoing Linux/Solaris Compromise Epidemic

Comments Filter:

  • Nothing to worry about (Score:5, Funny)

    by Rapid Home Offer ( 770408 ) * on Tuesday April 13, 2004 @07:39PM (#8855409) Homepage Journal
    From the article:
    The attacker appears to be deliberately targetting machines in academic and high performance computing environments, rather than attacking systems indiscriminately.
    I wouldn't worry too much. It's sounds like some guy is trying to boost his SETI@home [berkeley.edu] ranking.

  • Check out a good substitute for all your Linux (Score:3, Funny)

    by Anonymous Coward on Tuesday April 13, 2004 @07:41PM (#8855422)
    A good substitute for Linux and Sun boxes. My school migrated two years ago, weren't happier ever since.

    Here [microsoft.com] - those guys make a kernel, kickass GUI environment (faster than GNOME and easier to use than KDE) plus some office word editors and educational stuff like encyclopedias and maps.

  • I'm just glad... (Score:4, Funny)

    by Anonymous Coward on Tuesday April 13, 2004 @07:42PM (#8855433)
    I'm running Windows XP!

    aQazaQa

  • Windows is not the only vulnerable OS (Score:3, Insightful)

    by ObviousGuy ( 578567 ) <ObviousGuy@hotmail.com> on Tuesday April 13, 2004 @07:43PM (#8855443) Homepage Journal
    It is important that when we wave our flags and cheer when Microsoft is laid low by the latest security flaw that we not close our eyes to the very real vulnerabilities in the Unix/Linux system. No OS can be fully secured, and it is absolutely mandatory that we remain vigilant to the possibility of a heretofore unknown security hole in our systems, regardless of the system OS.

    Assuming that Unix/Linux is invulnerable to security holes is deadly. Though the OS may have more security features and "more eyes" on the code than closed source operating systems, we must not rest on our laurels watching Windows implode while our own house is burning.
    • You're joking.

      All the vulns mentioned have patches/fixes/replacements for the faulty code.

      The System Administrators are at fault FOR NOT MAINTAINING THEIR SYSTEMS PROPERLY.

      • Re:Windows is not the only vulnerable OS (Score:5, Insightful)

        by FrYGuY101 ( 770432 ) on Tuesday April 13, 2004 @08:04PM (#8855617) Journal
        How does that differ from the worms which get released for Microsoft almost a year after the patch was released? I hear people railing Microsoft all the time for not 'getting it right the first time' when THAT happens...
        • How does that differ from the worms which get released for Microsoft almost a year after the patch was released? I hear people railing Microsoft all the time for not 'getting it right the first time' when THAT happens...

          Wrong. People rail because Microsoft rarely gets it right the first time, and are damned slow and arrogant about fixing security holes. Oh, sorry. They did speed up their response time on security issues after realizing that the public was noticing and they were losing a little market share in IIS.

          • Most companies don't get it right the first time. If they did there would never be patches would there!

            People do like to slam MS about holes that have known fixes for them along with newly discovered holes

            I agree that MS have tighten up about security because of market share but this doesn't change the fact that some people will look at a situation like this in the linux world and point fingers at the admin for not having things up to date but in the MS world they'll blame MS first not the admin that hav

        • There is a well founded fear many Windows admins have about MS patches. They tend to break things. Patch Win2k, and MS-SQL does not work upon reboot. Or that third party medical charting software suddenly does not work.

          Windows is very complex (many would say "too complex"), and certainly suffers from the "integration" of its parts. Therefore, unintentional side effects of patches are envitable. With Unix(ish) systems, the descrete parts can be patched, well, descretely. You can patch Sendmail, or MySQL, or OpenSSL all by itself (although sometimes you must recompile applications that depend on shared libraries, such as OpenSSL).

        • When your business plan involves running a monopoly on the home desktop market you should be held to a different standard. You can't expect millions of computer novices to be knowledgeable or even aware of exploits or updates like the administer of a HPC pruning a UNIX based OS. The Internet is a community almost like any other. I don't need to list the advantages of having so many people wired, especially within such a short amount of time; but you can't expect the rapid influx of unsuspecting users to kno
        • How does that differ from the worms which get released for Microsoft almost a year after the patch was released?

          It's no different.

          I hear people railing Microsoft all the time for not 'getting it right the first time' when THAT happens...

          I also hear other people calling those first people idiots. No software is perfect. Security is a process. Patching is forever.

      • Re:Windows is not the only vulnerable OS (Score:5, Interesting)

        by jarich ( 733129 ) on Tuesday April 13, 2004 @08:12PM (#8855672) Homepage Journal
        Perhaps an alternative view...?

        The p;roblem, among others, is that we don't have enough real punishment going on for hacking activities.

        The internet has become the equivalent to living in a slum. Sure, the property is cheap, but if you don't have bars on your windows, you can count on a break in. And lots of people will tell you it's your own fault for not putting bars on your windows and living in a walled compound with broken glass on the tops of the walls.

        I agree that the systems should be patched, but the real problem is that there are communities of thugs who feel at liberty... NO, who ARE at liberty (due to the lack of a cohesive international enforcement) to do what ever they want to you machine.

        I vote for real international difficult (I know that's not going to be trivial) and hard jail time when people are caught. And, just like Kevin Mitnick, they should not be allowed to work with computers when they get out.

        • so do you think that its illegal to pick something up off of the sidewalk ?

          First and foremost "hacking" activities as you so aptly put it, are not the reason this is a problem, its the LACK of hacking activities at companies like MS that started this problem, they dont check their own software well enough. period.

          A hacker doesnt break the law (well any sane law, shit like the DMCA can fuck off) script kiddies and crackers are the one's who do shit like this.

          If you leave your system wide open it
          • its the LACK of hacking activities at companies like MS that started this problem

            According to a friend who used to work there, MS has teams of people whose job is to take their custom-built equipment anywhere they want on site and see if they can hack into systems.

            I'm not really sure what more they could be doing, other than allowing everybody to view their source code.
      • Eh in theory yes, in practice it is a little more difficult. Closed source kernel modules really complicate the whole upgrade right now issue, and even alot of open source modules can break between kernel versions. VMWare is used in alot of operating system courses (and thus on alot of acedemic computers), at the *very* least its modules need to be recompiled, although its pretty good at not breaking between kernel versions ... same with alsa, the nvidia-kernel, bestcrypt, and a million other modules.

        Th

      • I am a religious patcher. Hell, I've almost gotten a fired a few times when patches went wrong. Bosses just don't understand that machines don't just "work". They require constant intervention. The computers, that is, not the bosses.

        Now that said, you have an interesting slant on ethics. By that mindset, a burglar is perfectly entitled to break into your apartment because your door could be kicked in. A theif can swipe your radio because, hey, it was only glass between him and what he wanted.

        Yes, there is a certain amount to be said for not painting a target on yourself. But regardless of how much you "had it coming" it's still a crime to break into your dwelling, steal your property, or damage your person or posessions. System intrusion is a crime, and a matter for law enforcement.

        • I am a religious patcher.

          How's the reformation coming?

        • I read his comment more as the admins are more responsible for the problem than the programmers behind the OS. He never mentioned the people actually breaking in to the systems, obviously THEY are most at fault.

          Extending your analogy to what he actually said, Masterlock isn't responsible when you don't actually LOCK the damned lock. Which, of course, they aren't nor should anyone blame them for losses suffered from the inability of the purchasers of their equipment to properly USE that equipment.
      • Every single god damn worm would not work if users would patch their god damn systems. That's not news. Tell me something new to support that "Linux is secure" myth.

      • Re:Windows is not the only vulnerable OS (Score:3, Insightful)

        by Anonymous Coward
        We all know no patch has ever caused any problems with any server.(heavy sarcasm)

        I work with a large organization with hundreds of servers and no patch gets install until the patch is tested to make sure it does not break the business app. That means setting up a lab with as close to production setup as possible, install the patch and try to run some realistic tests to confirm that things work. If everything checks out then you can update that server. Repeat process for each application. Don't forget the m
      • Its hard to sit idly by as some statements like this are made. As an individual who has helped out with these systems and further helps maintain processes to keep systems up to date (almost all linux boxen involved use apt-get updates to state up to date pretty religiously), it has generally been the case the successfully attacked systems have come by unique approaches to each machine. Most have been indirect attacks via local root exploits using compromised user names from other institutions. Passwords are


    • It is important that when we wave our flags and cheer when Microsoft is laid low by the latest security flaw that we not close our eyes to the very real vulnerabilities in the Unix/Linux system.

      Don't kid yourself. This didn't happen. Linux isn't popular enough for this kind of attack. Heck. Ignore all that infosec history too. Didn't happen. Not popular.
    • Wow this got modded up to +5 while there were only 55 replies to the article, that's fast. Either you're popular or there are a lot of pissed off MS fans out there.

      It is important that when we wave our flags and cheer when Microsoft is laid low by the latest security flaw that we not close our eyes to the very real vulnerabilities in the Unix/Linux system.

      Is there really flag waving and cheering going on? Perhaps joking and laugher. Also Linux vs. Microsoft(leaving Unix out for now) is not comparable to
    • Straw, meet man.

      It is important that when we wave our flags and cheer when Microsoft is laid low by the latest security flaw that we not close our eyes to the very real vulnerabilities in the Unix/Linux system.

      No one is. Work is always being done to find and fix vulnerabilities in *nix variants.

      No OS can be fully secured

      No one with a brain ever claimed that was the case.

      Assuming that Unix/Linux is invulnerable to security holes is deadly.

      See last comment.

      Though the OS may have more security fe
    • These accounts are being attacked becuase somebody is using insecure transports and using the same password. That most likely means that these are unsophisticated users that use telnet (or possibly ftp) into probably MS systems (or possibly an old Unix, but that would surprise me). Once an attacker can get on the system, it is game over. Even if you are vigilient on security, there is no chance. The only chance is to keep them off. But of course, if users are lazy (and foolish), well....

  • In other words (Score:5, Insightful)

    by Rosco P. Coltrane ( 209368 ) on Tuesday April 13, 2004 @07:44PM (#8855446)
    a variety of local exploits, including the do_brk() and mremap() exploits on Linux

    In other words, Stanford doesn't keep its Linux boxes up to date. These exploits have been fixed. Linux too requires maintenance and patching, not just Windows.

    • Re:In other words (Score:5, Insightful)

      by winkydink ( 650484 ) * <sv.dude@gmail.com> on Tuesday April 13, 2004 @07:55PM (#8855542) Homepage Journal
      Maintaining a large, heterogenous environment (where administrative control may be decided by political or monetary reasons) is not easy to do. This may explain why you see so many really bright sysadmins at .edu's, but even they have difficulty breaking the political & financial layers.
      • Hey, I resemble that remark!

      • Re:In other words (Score:5, Informative)

        by ameoba ( 173803 ) on Tuesday April 13, 2004 @08:23PM (#8855754)
        A cluster is almost always _not_ a heterogenous environment. On top of that, the individual cluster machines should not have, nor do they need, access to the network as a whole. Compared to things like computer labs, HPC clusters should be the easiest thing to secure, since you -can- firewall the hell out of them.

        There's no excuse, when putting up a several hundred node cluster to not get an extra machine through which it needs to be accessed that is not part of the cluster. That machine can trivially be kept secure & the cluster can then be updated as is convenient (IE - not replacing the kernel in the middle of a 3-week long computation; even at that, tho, anything that's going to take 3wk should be able to checkpoint itself without loosing much).

        • Re:In other words (Score:4, Insightful)

          by KrispyKringle ( 672903 ) on Tuesday April 13, 2004 @09:59PM (#8856481)
          I don't think they mean clusters as in MOSIX, etc. The term seems to be used frequently in academia to refer to a group of machines, with load balancing between them, used for services like shell access, web and mail serving, etc. Additionally, individual servers are being attacked as well. Many schools have a very, shall we say, fragmented IT infrastructure; I'm at a medium-sized private university (about 10,000 undergrads, perhaps) with four different undergraduate schools and perhaps twice as many graduate schools. Each has its own IT department. The larger ones are well-run, but some of the smaller ones aren't even on the newsgroup of which all the IT departments are supposed to belong because they can't figure out how to use the news server (or so it's been said, at any rate). Point is, academia has some great admins, and some psych professors running servers out of their classrooms.

          Academic computing is the epitome of *available* computing, in the sense that availability is the highest priority. Financial institutions may prioritise (or at least, should prioritise) security and a good administration over availability, but by its nature, academic computing involves disparate infrastructures, various levels of admins with various goals, and so forth. All students, faculty, and staff need access; frequently, granting loose, unsecure access is simply more efficient for the time being than making things secure. Such is life.

    • They obviously forgot to reboot after those kernelpatches!

    • Re:In other words (Score:4, Insightful)

      by randyest ( 589159 ) on Tuesday April 13, 2004 @08:04PM (#8855609) Homepage
      Actually, it's users who are not following rules (assuming they have rules against using insecure telnet, which I'm sure they do):

      The attacks start with the compromise of an unprivileged local user account. Usually this is because the attacker's captured the password from somewhere else: it's been sniffed off the network (through the use of insecure protocols like telnet), it's been collected when the user signs on to or from another compromised machine, it's been harvested from the password file on a compromised system.

      So, we have user passwords as the source, which users freely give away by (1) using telnet instead of SSH, (2) just being very uninformed or gullible users, enough to plug in his/her unix password to a web form, and (3) once-removed version of (1) or (2) since these are just obtained from other compromised machines.

      (1) and (2) are arguably the same problem, so that boils down to: users breaking rules -- surprise! But, that's easy to say, but hard to fix without more power . What to do? Seriously? Fine users for breaking rules?

      • Re:In other words (Score:3, Insightful)

        by modecx ( 130548 )
        At my university nearly everyone used telnet to check their mail, and FTP on the big computer (ran AIX, probably still does). It's really quite stupid, especially when Free software exists for pretty much all platforms under the sun to easiy mitigate that risk.

        I once approaced one of the computer dorks at the lab about making PuTTY available to everyone on the lab computers, explaining packet sniffing (what's worse is that most of the individual labs were hubbed), and he turned me into the administration
    • As long as we are being consistent. If unpatched Windows boxes count when complaining about or keeping statistics on compromised systems then unpatched Linux boxes should count as well. Personally I believe Windows' perceived insecurity has more to do with poor administration than technical shortcomings, well at least with the NT family. Linux's intimidation of traditional PC users may work to Linux's benefit here, fewer PHB think they can have an "amateur" administer the Linux box as they believe they can

    • Re:In other words (Score:3, Insightful)

      by FireFury03 ( 653718 )
      In most cases, the attacker gets access to a machine by cracking or sniffing passwords. Local user accounts are escalated to root privileges by triggering a variety of local exploits

      The machines should of course be patched up to date, but I think the real failing here is the sysadmins not enforcing secure protocols - it doesn't take much to disable the telnet and ftp servers and make people use ssh and scp, etc instead. As soon as users are allowed to send authentication details in the clear instead of e

  • If you read to the VERY end of the article... (Score:5, Informative)

    by oldosadmin ( 759103 ) on Tuesday April 13, 2004 @07:45PM (#8855456) Homepage
    It says that good passwords are a good defense.
    We know this.
    No more default last 4 digits of SSN as a password.
    Make them use something more secure! And disable telnet, for goodness sakes.
    Inconvieience (sp?) your students in order to secure your system. It's all fun and games until someone uses a rootkit to play with GPAs.
    • It's all fun and games until someone uses a rootkit to play with GPAs.

      Any institution that maintains it's confidential grading records on the same network as academic computing (or even attached to the academic network in any way) deserves every lawsuit that such an action should engender.
    • It's all fun and games until someone uses a rootkit to play with GPAs.

      Then it's a sport. :)

    • ...Is that you cannot make sure your users are careful.

      You pretty much have to assume that black-hats are going to be able to runs escalation exploits and work accordingly. That or severely limit how users are allowed to interact with the machine (if they only need to access email or upload files, WTF should they be able to run anything else?).

      But yeah, good passwords limit the opportunities.

      Xix.

  • IMO all of these attacks are related (Score:4, Interesting)

    by bersl2 ( 689221 ) on Tuesday April 13, 2004 @07:46PM (#8855464) Journal
    going back to the back-door insertion attempt on the Kernel, the rooting of gnu.org's ftp server, the compromise of Debian's servers... it's the same people doing this.

    Just a feeling.

  • Washingtonpost.com has the complete story (Score:5, Informative)

    by tsu doh nimh ( 609154 ) on Tuesday April 13, 2004 @07:47PM (#8855476)
    on just how widespread this attack really is. The story IS HERE [washingtonpost.com]

  • Hmm, doesn't seem very unusual. (Score:5, Informative)

    by mtnharo ( 523610 ) <greengeekNO@SPAMearthlink.net> on Tuesday April 13, 2004 @07:48PM (#8855484) Homepage
    Someone is sniffing passwords off the network (telnet or http sessions probably) or cracking badly chosen ones, and then using privilage escalation vulnerabilities that have been known and patched for quite a while. However, this kind of thing can work at an academic environment or other large network, since it is often not possible to upgrade the kernel on every single system without proper testing. Still, come things can be done to prevent this kind of attack.

    Don't send passwords in plain text on the network, and enforce proper password policies (8 char minimum, numbers, letters and symbols etc).

    • Re:Hmm, doesn't seem very unusual. (Score:4, Informative)

      by achurch ( 201270 ) on Tuesday April 13, 2004 @07:58PM (#8855568) Homepage

      enforce proper password policies (8 char minimum, numbers, letters and symbols etc).

      I've always been against this, or at least the more anal implementations of it, in that forcing people to choose hard-to-remember passwords typically leads to writing the passwords down--often in obvious places--which makes the problem worse instead of better. Good encryption (e.g. ssh instead of telnet) and good security measures (e.g. shadow passwords) are much more effective than draconian policies that don't achieve their ends anyway.

      (And as for numbers and symbols making passwords less crackable--admit it, how many of you use 1337speak to make up the number/symbol quota?)

      • Re:Hmm, doesn't seem very unusual. (Score:4, Funny)

        by Spoke ( 6112 ) on Tuesday April 13, 2004 @08:16PM (#8855706)
        (And as for numbers and symbols making passwords less crackable--admit it, how many of you use 1337speak to make up the number/symbol quota?)
        Doh, how did you know my password was 1337speak? I better change now that you've posted it on Slashdot!
      • Or how about just not permitting any sort of shell access? Provide services, like imap-ssl, pop3-ssl, web, etc but no shell accounts. Only login is from root over ssh2... keep it patched. If you're going to allow anonymous ftp access make sure folks can upload but not download until stuff gets moved to /pub... for God's sake make sure that you're chrooted into your user/anon directory and you can't check out /etc

        Sounds to me like admin's aren't being responsible with server accounts, shame on them. We
      • He didn't say 'require unmemorizeable passwords', just 'require passwords with characteristics that make them difficult to crack'.

        An excellent point, however, that that standard 1337 letter-number substitutions do basically nothing to improve your password security, as any half-decent password cracker will try those substitutions early in a dictionary attack.

        I recommend the use of symbols where appropriate (throwing a !, ^ or & into your password won't hurt) and taking the time to try to pick a good p
      • Any admin needs to abolish telnet and unencrypted http passwords. The first step in security is the password layer and they're just wasting that. The privlidge elevation bugs are a problem, but they should be keeping important servers up to date with only a short testing delay. Linux may be secure, but it's by no means perfect.
    • Someone is sniffing passwords off the network (telnet or http sessions probably) or cracking badly chosen ones

      They could be using hardware keyloggers, in which case NO machine is invulnerable.

  • Note to self (Score:5, Funny)

    by UnknowingFool ( 672806 ) on Tuesday April 13, 2004 @07:48PM (#8855485)
    Change Linux root password from 1234 to something harder to guess

  • Sloppy work all around (Score:5, Insightful)

    by fastpage ( 125435 ) on Tuesday April 13, 2004 @07:49PM (#8855487)
    What gets me is that you can tell the white hats and black hats are both lazy.

    If the sysadmins had actually patched their servers with the appropriate security patches the "hackers" would have never gotten in, in the first place. If you read the counter measure section this isn't anything new that they shouldn't be doing every day and enforcing.

    If you look at the section entitled Evidence of compromise you can see that the people breaking into the systems are leaving a pretty big trail to follow. In my job, when customers start complaining that their servers are working quite right, when you take a look at whats going on you can see a root kits been installed. The whole idea of a root kit is to cover your tracks. If these guys did a better job you'd never know you were hacked. Its quite sad really. Laziness is the biggest security problem if you ask me.
    • Maybe they're doing it as a wake-up call for all. They seem to be busy and motivated, but still leaving enough evidence to alert many people as they go. Nothing malicous like deleting data has been reported, just a trail of root kits and exploits. It'll probably result is many more secure systems all round after it's over.

  • Been hitting Caltech too (Score:4, Informative)

    by Anonymous Coward on Tuesday April 13, 2004 @07:50PM (#8855499)
    Servers were down much of last week. The ITS website [caltech.edu] has a few brief details.

  • Yeah, so? (Score:5, Interesting)

    by ameoba ( 173803 ) on Tuesday April 13, 2004 @07:53PM (#8855522)
    The entire (up to date) Windows lab here gets compromised & backdoored to hell and everyone just says "Have it working by tommorrow". A Linux cluster gets compromised and they issue a press-conference.

  • HPC Clusters? (Score:4, Funny)

    by JessLeah ( 625838 ) on Tuesday April 13, 2004 @07:53PM (#8855525)
    Isn't that an oxymoron? Cray Canada's CTO says so [slashdot.org]. Then again, Borland's CTO said "OS X is my favorite Linux distribution [linuxjournal.com].", so maybe CTOs aren't so smart about Technology after all ;)
    • I think he was being clever, but I wasn't there to personally witness the quote. I think what he was saying, in a roundabout kind of way was "OS X is kind of like linux, but I like it even more."

  • My opinion (Score:3, Interesting)

    by weekendwarrior1980 ( 768311 ) on Tuesday April 13, 2004 @07:55PM (#8855543) Homepage
    I dont think we will ever have a fully secure box, these vulnerabilies will continue to pop up occassionally and there's nothing we (the developers) can do about that. It is just a testimony of the fact that we are imperfect beings and sooner or later we will have our errors exposed. It is not a bad thing, in the evolutionary way of dealing things, this (finding and sorting out bugs) could probably be a good thing. Having said that, I think developers do have control over how they respond to these problems, like coming up a problem that doesn't just band-aid the wound hoping to find a cure for in the future. Also developers have control over how fast they respond. On both criterias, open source peer reviewing is winner over closed sourced development. One tends to promote security through openness and and in the other security through obscurity like think MSFT( Read comments from a MSFT bigwig who said the only reason MSFT servers are compromised because the vulnerabilities are announced).

  • they wanna know WHAT? (Score:4, Insightful)

    by ChipMonk ( 711367 ) on Tuesday April 13, 2004 @08:00PM (#8855582) Journal
    If you believe your Unix computer has been affected by these intrusions, please contact the Information Security Services office (650-723-2911 or security@stanford.edu). Please include the name or IP address of the affected machine, as well as any compromised userIDs.

    Never mind the compromised machines. Let's try social engineering instead. I know! We'll make a security alert, get it on Slashdot, and the poor trusting souls will beat a path to our POP3 account!

    Seriously, you might as well just hand them your hard drive and credit card number.

  • HPC question (Score:2, Insightful)

    by abrotman ( 323016 )
    could someone more familiar with HPC systems please explain to me why any cluster is attached to the internet? I'm assuming these are externally routable addresses. I just dont understand why you would do this.

  • Libsafe protects against buffer overflow exploits (Score:5, Interesting)

    by tjmather ( 206288 ) * on Tuesday April 13, 2004 @08:05PM (#8855623) Homepage
    Does anyone use Libsafe [avayalabs.com] This library protects against buffer overflow vulnerabilities, and is very easy to install (basically you just install the RPM and you're done)

    If more sysadmins installed this, perhaps we wouldn't have problems with so many Linux compromises? Of course it's no substitute for patching, but seems like a good additional security measure.

    This is from the gnu.org software directory [gnu.org]

    The exploitation of buffer overflow and format string vulnerabilities in process stacks are a significant portion of security attacks. 'libsafe' is based on a middleware software layer that intercepts all function calls made to library functions known to be vulnerable. A substitute version of the corresponding function implements the original function in a way that ensures that any buffer overflows are contained within the current stack frame, which prevents attackers from overwriting the return address and hijacking the control flow of a running program.

    The true benefit of using libsafe is protection against future attacks on programs not yet known to be vulnerable. The performance overhead of libsafe is negligible, it does not require changes to the OS, it works with existing binary programs, and it does not need access to the source code of defective programs, or recompilation or off-line processing of binaries.

  • Imagine... (Score:5, Funny)

    by Odin's Raven ( 145278 ) on Tuesday April 13, 2004 @08:08PM (#8855641)

    From the Stanford article:

    Stanford, along with a large number of research institutions and high performance computing centers...

    And further down...

    ...the compromised user account is typically used to run a password decoding application called John the Ripper...

    To paraphrase a cliche without any attempt at humor:

    Imagine a Beowulf cluster running John the Ripper.

    /me runs and hides in cellar...



    • Imagine a Beowulf cluster running John the Ripper.

      Never did that. But did, on occasion, have a Cray running crack.

      Nobody appreciated the quips about a crack-using Cray though.

  • Now, wait a moment ... (Score:5, Interesting)

    by JMZorko ( 150414 ) on Tuesday April 13, 2004 @08:08PM (#8855644) Homepage
    Just an observation, but this story has the "Security" icon, while the story about Windows critical flaws has the "Bugs" icon. Both stories deal with bugs or "vulnerabilities" that compromise security on the affected machines.

    Now, my opinion of MS is not that great, but this just seems wrong.

    Regards,

    John

    • Now, my opinion of MS is not that great, but this just seems wrong

      Not really, if one of the companies is a cockroach.

    • Re:Now, wait a moment ... (Score:4, Informative)

      by c0dedude ( 587568 ) on Tuesday April 13, 2004 @08:30PM (#8855818)
      Not really. The vulnerablities in Linux/Solaris have been fixed, thus it is a security issue. The vulnerablities in Windows are still current, thus it is a bug.

    • Re:Now, wait a moment ... (Score:4, Interesting)

      by CAIMLAS ( 41445 ) on Tuesday April 13, 2004 @08:31PM (#8855823)
      This is why you should at least try to pay attention; reading the article would help, too.

      This article is about incompetent admins and actual security breaches using exploits that have had fixes for ages. Thus, security. The windows item was on patches for actual bugs and didn't mention any specific exploit instances: thus, bugs.

      It all makes sense now, doesn't it?

      • No (Score:3, Insightful)

        by spoco2 ( 322835 )
        No, it doesn't... many of the same types of reports about windows attacks are ALSO due to UNPATCHED machines.

        It's the one-eyed, severely slanted nature of the Slashdot readership that:
        * Microsoft is evil, stupid, moronic, evil, nasty, unsafe, did I mention evil?
        * Linux is the shining non-denominational grail.

        For god sake, there are security vulnerabilities in both people... and they aren't taken advantage of within the *nix world, because... hey, guess what? The majority of users are computer savvy, and k

        • Re:No (Score:3, Interesting)

          by glwtta ( 532858 )
          * Microsoft is evil, stupid, moronic, evil, nasty, unsafe, did I mention evil?

          Well... yeah, they are, what's really the problem with admitting that? We know something about the company and their track-record, why should that not be allowed to colour our current opinion of them?

  • For a moment there, I thought they were saying that Solaris and Linux were making compromises in order to become more alike or that universities were compromising by installing Linux on some of their SPARC machines, and that people were saying that it was an epidemic.

    Oh well.

  • academic machines? (Score:4, Interesting)

    by dj245 ( 732906 ) on Tuesday April 13, 2004 @08:23PM (#8855756)
    article: The attacker appears to be deliberately targetting machines in academic and high performance computing environments, rather than attacking systems indiscriminately.

    I can see why they would want to target academic boxen if they wanted high-powered computers to do some serious slaved number crunching. If they are just going to launch a DDoS attack or send a bunch of spam though, academic computers are not the best. Most academic sysadmins have fairly limited budgets, and spend a fair amount on bandwidth. As such, they rule their bandwidth with an iron fist in many cases. The Admins at my particular college have bandwidth flags on certain ports and a global flag of somewhere around 1gb/day over 3 days. Break that, and the admin gets very interested in what you are doing with your boxen.

    I'm sure other colleges have similar schemes, and I've heard of many colleges which are even more strict with their bandwith (200mb/day limit, etc). These academic boxes may make good targets because of their relatively user intervention and user experience, but they don't have that great of a pipe on them, relatively speaking. If it was me, I would have gone after servers that also run wireless access points. Hard to tell where the bandwidth goes in some cases with those.

  • this just in... (Score:4, Funny)

    by medelliadegray ( 705137 ) on Tuesday April 13, 2004 @08:34PM (#8855841)
    PC's get compromised if security patches are not applied!

    and in other news...
    cheerio's get soggy in milk

  • Comment removed (Score:5, Funny)

    by account_deleted ( 4530225 ) on Tuesday April 13, 2004 @08:38PM (#8855874)
    Comment removed based on user account deletion
  • poor password management is the source of most hacks. i'm betting this cracker has a chip on his shoulder and is out to teach this org a lesson. gaining local access is 1/2 the battle, which is made easy when you use passwords like "password"

  • Strategic issues (Score:4, Interesting)

    by Animats ( 122034 ) on Tuesday April 13, 2004 @08:49PM (#8855962) Homepage
    We're seeing more attacks that seem to be Phase I of something big. Somebody is going to considerable trouble to prepare for something. But what?

    I see a day coming when, in one day, half the computers in the US have their disks erased.

  • The Washington Post has more coverage (Score:4, Informative)

    by Doofus ( 43075 ) on Tuesday April 13, 2004 @09:12PM (#8856153)

    Washington Post has more coverage in this article, Hackers Strike Advanced Computing Networks [washingtonpost.com].

  • A few things to try..... (Score:5, Informative)

    by Mercury2k ( 133466 ) on Wednesday April 14, 2004 @12:10AM (#8857303)
    Here is a list of some things that I feel are worth considering:

    1. Patch your system! As soon as a patch comes out, get it applied and reboot if you have to! Also, stay up to date on security issues by subscribing to mailing lists that are related to the software your using. One good general purpose site is cert.org [cert.org]. Keep in mind that while mailing lists are great ways of being notified, they arent fool proof. If your subscription expires and you dont know about it, you wont be exactly up to date in the community now will you?

    2. Use grsecurity [grsecurity.net]. This is a kernel patch that is briefly lagged behind official Linux kernel versions. It has many great features for protecting against stack attacks/buffer overflows. ie: Those latest greatest scripts your local script kiddie just downloaded wont likely do anything against you since special addresses are randomised. It can also hide files on your computer such as intergrity checkers so nobody except you know they exist. Plus it can stop insert code into a running kernel by making kernel memory readonly (which btw, would have prevented at least one of the attacks they mentioned).

    3. Install a filesystem intergrity checker. Aide, integrit and tripwire all come to mind and essentially all do the same thing but with different config file syntax. Besides, how can you tell if a file is changed if you dont actually check? Also, dont forget to hide the existence of this program using something like grsec's gradm filesystem ACL util and be careful of automating checks in the crontab!

    4. Read a good linux securing article. One such article I have read is called Securing & Optimizing Linux: The Ultimate Solution [tldp.org]. It will teach you how to lock a system down a fair bit and how to remove unused/unneeded services from your computer.

    5. Watch those logs! Log files provide a wealth of information, but administrators rarely check them (well, not all). If you dont know what a log entry means, research it, or else you may be looking at an attack and not even realise it. Now I know some of you are thinking I am nuts considering just how many logs even a small system generates, but there are tools to help you. One way is to use a program called swatch (a perl script). It can parse existing and old archived log files using a perl regex syntax and trigger actions based on found text. Start by configuring the system to ignore any log entries that are known to be friendly and show you everything. Then slowly eliminate each friendly entry one at a time. What will be left is a list of purely evil enteries :). Next configure swatch to alert you upon recieving such messages! Of course you can always use perl or even grep -v to parse logs, but for repeated use I think a specialised tool would save you some trouble in the long run.

    Now I know I could go on forever with suggestions, but I think that these few things should give anyone a kick in the right direction. I hope this has been helpful.

  • not always .edu's fault (Score:3, Interesting)

    by eufaula ( 163352 ) on Wednesday April 14, 2004 @02:33PM (#8863009) Journal
    we have a sun system at our institution that runs a webserver for a very specific application. an unnamed vendor (we'll keep it that way) installed this machine and pretty much told us to keep hands-off of it except to change the backup tape. if we made any modifications to the machine or its software, then our service agreement was void and they would not support this particular app. so, we firewall the crap out of this thing, only allowing access to httpd (apache), making sure to explictly block any high port in use. well, this machine gets compromised about a week ago because this vendor has an ancient version of apache (1.3.3 or something) running suid/sgid root. idiots.......this is a problem we could have prevented if our vendor wasnt as dumb as they were. being a small .edu, we cant just pack up and change without spending 6 figures, so we are pretty much stuck with it until their contract comes up in a couple of years (this is an inherited problem). want their take on the problem - apache only will work suid/sgid. wont run unless permissions are that way. so i ask them to change it, and after about 10 minutes of arguing with their lead UNIX guy he does so. he was amazed that it would run......

Slashdot Top Deals

Your own mileage may vary.

Close